S
SA - security analysis (security assessment) (General term for an analysis of security functions at an organization - Can apply to overall organizational security, or an analysis of different areas, such as departments, like the information technology (IT) or marketing departments, or more generally, by category, such as systems or network security, or physical security, involving buildings, plants, or facilities, or, on a larger scale, of electric utility power grids or water or gas delivery systems.)
SA - security assessment (security analysis) (Alternate term for security analysis involving an analysis of security functions at an organization - Can apply to overall organizational security, or an analysis of different areas, such as departments, like the information technology (IT) or marketing departments, or more generally, by category, such as systems or network security, or physical security, involving buildings, plants, or facilities, or, on a larger scale, of electric utility power grids or water or gas delivery systems.)
SA - security association (Basic element or core operating function of the ISAKMP (Internet Security Association and Key Management Protocol) which serves to manage key distribution and operation.)
SA - System Administrator (Individual with responsibility for managing and administering an organization's systems.)
SA&A - Security Assessment and Authorization (Formal methodology for testing and evaluating the security controls of a system to ensure that it is configured properly to meet the security mandate of the Federal Information Security Management Act (FISMA) which applies to federal information systems. The methodology was developed by the National Institute of Standards and Technology (NIST).)
SaaS - Software-as-a-Service (A cloud-based service in which the cloud services provider offers software applications to the client and provides network, servers, operating systems, storage, or even individual application capabilities.)
SAISO - Senior Agency Information Security Officer (In the federal system, under the Federal Information Security Management Act (FISMA), the official responsible for ensuring compliance with FISMA and other applicable information security requirements - responsibilities and duties may vary, depending on the agency or location.)
SAML - Security Assertion Markup Language (OASIS (Organization for the Advancement of Structured Information Standards) standard for federated identity management which supports both authentication and authorization. Assertions are based on XML and are used between an identity provider and a relying party.)
SAN - storage area network (Numerous storage devices linked together by a high-speed private network and storage-specific switches.)
SANS Institute - SysAdmin (System Administrator), Audit, Networking, and Security Institute (A private company formed in 1989 that provides training for the cyber security industry.)
SAPs - Special Access Programs (U.S. military programs created to control access, distribution, and protection of particularly sensitive information, including top-secret military information.)
SAR - Security Assessment Report (Report documenting the results of the Security Control Assessment required by the Risk Management Framework (RMF) for government agencies which discusses the security controls selected, whether implementation was appropriate, and weaknesses or deficiencies found.)
SASE - secure access service edge (Security model which combines a wide range of network security capabilities which streamlines management and enhances security in cloud-based infrastructures.)
SAST - Static Application Security Testing (A white-box testing tool that determines security vulnerabilities from the inside-out by examining the source code of an application. SAST can be used at all points of the software development development lifecycle (SDLC).)
SBU - sensitive but unclassified (Information classification used by the military for information which is sensitive, such as medical information or test scores, but which is less than a "secret" or "top-secret" category.)
SCA - Security Control Assessment (The testing and/or evaluation of the management, operational, and technical security controls to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for an information system or organization.)
SCADA - Supervisory Control and Data Acquisition system (Highly distributed system(s) used to control geographically dispersed assets, often scattered over thousands of square kilometers/miles, where centralized data acquisition and control are critical to system operation. System typically found in utility power grids covering states or regions.)
SCAP - Security Content Automation Protocol (A set of specifications that provide standard data formats, naming conventions, and development approaches for structuring source data intended to facilitate automated monitoring. Allows data transmission in standard formats, production of reports conforming to specifications, enabling greater automation of data collection.)
SCI - Sensitive Compartmented Information (Classification system used by the U.S. for top-secret information involving non-military agencies of the intelligence community, such as the NSA, CIA, and FBI.)
SCM - Service Control Manager (Function in Windows which provides capabilities to add, change, edit, or change offered services.)
SCP - Secure Copy Protocol (Protocol which provides a secure file-transfer method from a remote server to a local system, ensuring that data in transit is kept confidential. Many SCP products use an SSH (Secure Shell) connection to ensure security.)
SD - Secure Digital card (A type of flash-memory nonvolatile storage device that incorporates a cryptographic security system to prevent copyright violations, intended for uee in digital music players. SD cards are commonly used in digital cameras, smartphones, and gaming consoles.)
SDLC - Software Development Life Cycle (Process model for, or description of, the stages involved in a software project, from conception through implementation. Although there are several different models, most involve a project start, beginning with a data gathering phase, involving a determination of the requirements for software needs and expectations, a design phase, involving the specific functions and goals of the project, a development phase, involving the actual programming of software code, a testing/validation phase, where the software is tested to see if it works as planned, and finally, a release/maintenance phase, involving the operational deployment into the working environment.)
SDLC - System Development Life Cycle (Process model for, or description of, the stages involved in a system project, from conception through implementation. (The development cycle for systems is similar to that for software, although it involves larger, system-focused goals, rather than specific software.) System development models may differ but most will involve a project start, beginning with a data gathering phase, involving a determination of the requirements for system, department, or organizational needs and expectations, a design phase, involving the specific functions and goals of the project, a development phase, involving the actual programming of software code, a testing/validation phase, where the system is tested to see if it works as planned, and finally, a release/maintenance phase, involving the operational deployment of the system into the working environment.)
SDN - Software Defined Networking (An architectural concept, increasingly employed in a cloud computing environment, that enables centralized management and emphasizes the role of software in running networks to dynamically control, change, and manage network behavior. The virtual environment created by SDN, and its reliance on software contrasts with traditional networks, which consist of one or multiple physical servers in multiple geographical locations involving hardware and network devices which must be individually configured.)
SDI - Software Defined Infrastructure (Also known as Infrastructure-as-Code (IaC)) (A process for automating deployment of a virtual infrastructure using templates, which includes the ability to create templates of network configurations.)
SDP - Session Discovery Protocol (Standard which documents a common language to define required information between two parties so they can then establish a connection with each other. SDP represents a potential vulnerability for cyber attacks, since its documentation can be used to extract the internal IP addresses of an organization.)
SDP - Software Defined Perimeter (Cloud Security Alliance (CSA) framework that combines device authentication and user authentication to dynamically allow or deny network access to resources.)
SecaaS - Security-as-a-Service (A seurity-focused Software-as-a-Service (SaaS) product that can be used to protect cloud and traditional IT assets.)
SecDevOps - Security Development Operations (Variation of DevSecOps (Development Security Operations) which emphasizes security (Sec) in the process of software development (Dev) and software operations (Ops). Practice has emphasized the automation of core security tasks by embedding security controls into the DevOps workflow.)
SEIM - Security Event and Information Monitoring (Real-time tool used to automate security monitoring of intrusion or attack activity, a step above just a review of event logs.)
SEM - security event management (also referred to as security threat management (STM)) (Tool or service which collects log information from various sources in a network, such as operating systems, security devices, and applications, analyzes and correlates the log data, to identify possible links or patterns, and reports potentially major incidents, as alerts or alarms, in real-time to an operator, for further investigation. Early SEM tools were primarily involved in the identification of suspicious activity to be investigated. The SEM/STM function was an early version of security technology which would later be merged with security information management (SIM) (responding to and dealing with events) to form the current model, security information and event management (SIEM), which both looks for threat activity and acts to contain or eliminate threats.)
SESAME - Secure European System for Applications in a Multi-Vendor Environment (A research and development project funded by the European Commission intended to improve encryption key capabilities.)
SET - Secure Electronic Transaction (A proposed security technology for sending encrypted credit card numbers over the Internet.)
SFTP - Secure File Transfer Protocol (An interactive file transfer protocol that encrypts all traffic between the SFTP client and the SFTP server.)
SGIP - Smart Grid Investment Program (A U.S Department of Energy (DOE) program which provided matching funds for U.S. utilities for purchasing certain kinds of new equipment.)
SHA - Secure Hash Algorithm (An algorithm producing random values incorporated into an encrypted transmission, which was intended to be used with the Digital Signature Standard (DSS).)
SID - security identifier (A numerical identifier in Windows systems used to identify a specific account or group. Similar to the concept of user IDs (UIDs) in UNIX systems.)
SIEM - Security Information and Event Management (Umbrella term for advanced technological systems capable of monitoring entire networks and systems on a continuing (real-time) basis, analyzing log activity data, and generating reports in real time. Began as security event management (SEM) or security threat management (STM) which largely involved "events" or specific threat analysis, correlation of data with incidents, and providing a response to immediate threats. As computer power and capabilities grew, SEM was consolidated with the security information management (SIM) function, involving expanded log searches, archiving, forensic investigations, and data mining. The latest generation of SIEM systems have expanded to "big data security analytics" to analyze large amounts of data over long periods of time, and in addition to data mining of available data, in some cases to incorporate outside intelligence data about current world-wide attacks, as well as providing automated threat response. Advanced SIEM capabilities require advanced technology, are very expensive, in terms of equipment and software, as well as a dollar commitment for full-time staffing, which makes them practical only for very large companies or organizations.)
SIF - Safety Instrumented Function (A category, process or type of industrial process safety system employed to protect an industrial facility or process from attack.)
SIIR - Security Incident Investigation and Response Service (Service responsible for the investigation into reported security incidents and managing an appropriate response, with the goal of ensuring a consistent and effective approach to the management of information security incidents.)
SIM - Security Information Management (Tools and security procedures which focused on analysis of log data and systems which could provide clues or information about attacks - it could involve archiving, historical reporting, forensic investigations, and date mining. SIM was more of a reporting and analysis tool, rather than a response or security activity. It would be combined with security event management (SEM) into current Security Information and Event Management (SIEM) systems, which provided enhanced information analysis and security response capabilities.)
SIP - Session Initiation Protocol (A Voice over Internet Protocol (VoIP) signaling protocol used to set up, maintiain and tear down (end) VoIP phone calls.)
SIRT - Security Incident Response Team (A team of people or unit within an organization which is organized to identify and respond to security incidents.)
SIS - Safety Instrumented Systems (Early industrial process safety systems which, until the 1960s and 1970s, were comprised of simple pneumatic, hydraulic, or electromechanical relay circuits designed to shut down or reduce operations, when systems approached and unsafe condition.)
SISO - Senior Information Security Officer (Senior agency official within the Federal Information Security Management Act (FISMA) responsible for ensuring agency compliance with FISMA information security requirements, for reporting compliance, and with responsibility for security. More generally, a title used by organizations for senior-level officials responsible for information security of systems, although responsibilities may vary.)
SKA - shared key authentication (Method of wireless authentication in which a wireless device authenticates itself to a network by proving it has the necessary encryption key.)
SLA - service level agreement (A contractual agreement, signed by an organization and a third-party provider, that details the obligations and rights of each party, and the specific services that will be provided by the third-party.)
SLC - system life cycle (A description or listing of the different phases a system will go through during its life, starting with project initiation and planning and ending with disposal. While the steps included or descriptions of each phase may vary, they will generally include a planning phase, which will include an analysis of needs and a determination of specific requirements, a building phase, which may include hardware acquisition and program coding, a testing phase, an implementation phase, involving staff training, an operations and maintenance phase, once a system is in use, and finally, a disposal phase, when the system reaches the end of its useful life.)
SLE - single loss expectency (An estimate of the expected loss for a single asset (dollar amount of the loss of an asset, combined with an estimate of the likelihood the loss will occur) from a single event, i.e., how much will the damage or theft of a computer cost, factoring in the likelihood that the damage or theft will or will not occur.)
SLMS - security log management service (Service responsible for collecting, normalizing, parsing, and storing security-relevant log data from network, security, and host systems and to provide access to those logs for consumption by various monitoring and reporting tools.)
SMA - Secure Mobile Access (Procedures, steps taken, and requirements to ensure that mobile devices, programs, and data stored on those devices is secure, and that mobile access to systems is secure.)
SMB - Server Message Block (Protocol used to share files, printers, and other network resources.)
SMEs - Small and Medium-Sized Enterprises (Term used in the European Union (EU) for individually-owned businesses and smaller companies, in contrast to large companies or international corporations.)
SME - subject matter expert (Someone considered to have experience in or having deep specialized expertise and familiarity with an area or topic of need or interest.)
SMI - Security Management Interfaces (Interfaces used to configure and manage the security of the software itself. These are administrative interfaces with high levels of privilege. SMIs can be used for tasks such as adding users, deleting users, enabling or disabling user accounts, as well as granting rights and privileges to rules, changing security settings, configuring audit log settings and trails, and exception logging. )
SMTP - Simple Mail Transfer Protocol (Server-side e-mail protocol used to send e-mail messages from an organization's e-mail server.)
SNAT - Static Network Address Translation (Method of configuring the mapping of an inside local address directly, so that it does not change and is not dynamically assigned.)
SND - Secure Network Detection (Intrusion prevention device or software function with the capability of detecting when a mobile device or connection is operating from a system outside a trusted network.)
SNMP - Simple Network Management Protocol (A protocol used to monitor and manage network devices, such as routers, switches, and servers. SNMP has two main components: 1) managers (server portion) and 2) agents (software running on a network device).)
SNTP - Simple Network Time Protocol (A protocol used to support time synchronization among network devices. Similar to Network Time Protocol (NTP), but less complex and not as accurate.)
SOA - Start of Authority (Record type within the Domain Name System (DNS) which provides information about a DNS zone (an administrative subdivision containing names), such as e-mail contact information for the zone's administrator, the zone's primary name server, and various refresh timers.)
SOA - service-oriented architecture (A modular, or compartmentalized, system architecture which allows individuals or multiple users to call up pre-programmed functions, applications, or services, in effect, to share data or a database stored in a centralized place with other users, without the need for each user to possess their own code or functionality.)
SOAR - Security Orchestration, Automation, and Response (Refers to technologies that enable organizations to collect inputs monitored by the security operations team, to automate the procedures related to security response, and to provide more effective and faster response capabilities - combines human oversight and analysis with machine learning and computer capabilities in order to automate procedures.)
SOC - Security Operations Center (In the area of cybersecurity, a facility or location where a group of people, using specialized technologies, work together to deal with security threats, although the threats and responses may differ and may be the responsibility of special units or teams of individuals, depending on whether their capabilities, experience, or focus is prevention, detection, investigation, or response to cybesecurity threats and incidents. Depending on the size and budget of an organization, there may be different types of response centers which qualify as SOCs, with different names, goals, or functions, such as a network operations center (NOC), an emergency operations center (EOC), a mission operations center (MOC), or a threat operations center (TOC).)
SOC - Service Organization Controls (security controls over/monitoring of service organizations - vendors, businesses providing outsourced services to an organization (not to be confused with charitable organizations) - standards falling under Statements on Standards for Attestation Engagements (SSAE) 16 after 2011 - replaced by the term "System and Organization Controls" in 2017)
SOC - System and Organization Controls (system-level controls related to third-party organizations providing services to organizations - vendors, businesses providing outsourced services to an organization in specialized areas, such as claims processing, data processing - standards falling under Statements on Standards for Attestation Engagements (SSAE) 18 after 2017 - replaced the earler term "Service Organization Controls")
SOC - System on a Chip (Concept extensively used in the semiconductor industry to describe chips developed for a specific task or application, which can then be integrated into a larger system.)
SOCaaS - security operations center-as-a-service (third-party/outside contractor provider of security services) (security)
SOHO - small office/home office (A classification of networking equipment, usually marketed to consumers or small businesses, that focuses on low price and ease of configuration.)
SOP - Same Origin Policy (A security policy which restricts website interactions with websites off unrelated origin. Web pages having the same hostname, scheme, and port are deemed to reside at the same origin and are allowed to interact without restriction.)
SOP - Standard Operating Procedure(s) (Routine procedures followed for most situations encountered.)
SORN - System of Records Notice (Public notification procedures which federal agencies must follow to inform the public of actions or changes taken by the agency - considered satisfied by publication in the Federal Register.)
SP - special publication (Publication issued by the National Institute of Standards and Technology (NIST) dealing with and providing guidance on a specific topic.)
SPAM - Term, not an acronym, originating/referring to the canned meat, used to refer to a large volume of unwanted or unsolicited e-mail or instant messaging sent to or received by a recipient.
SPF - Sender Policy Framework (E-mail validation system designed to prevent e-mail spam (or forged messages) by detecting e-mail spoofing through verification of the sender's IP address.)
SPI - Security Parameter Index (A unique value assigned to a communication between two parties. It is a tag that identifies pre-selected encryption rules and algorithms when more than one transmission session is being conducted.)
SPI - Stateful Packet Inspection firewall (A firewall packet inspection process which analyzes incoming packets to determine the external originating source as well as the destination on the internal network. In addition a stateful firewall tracks packet transaction history in a "state table" which it uses to compare with new packets entering the firewall to determine whether to allow or deny access.)
SPIM - Spam over Instant Messaging (SPAM sent/receeived over chat and instant messaging (IM) services, often used on mobile devices to communicate.)
SPIT - Spam over Internet Telephony (Spam sent over Voice over Internet Protocol (VoIP) networks (voicemail).)
SPP - Security and Privacy Profile
SPTs - Smart Persistent Threats (Class of cyber attack or attacker with good technological skills, access to advanced technology, and with the resources, interest, and capabilities to conduct attacks over an extended period of time. Threats from nation-states, criminal gangs, and cause-oriented individuals would normally be included in this category.)
SQL - Structured Query Language (A standard programming language used to allow clients to interact with (or express queries of) a database, allowing clients to carry out operations such as inserting, updating, searching, and committing data.)
SRM - Service Component Reference Model
SSAA - system security authorization agreement (Formal documentation and approval "contract" required by the U.S. Department of Defense (DoD) for system security projects which details the system requirements and plans, along with steps for certification.)
SSDLC - Secure Software Development Lifecycle (Describes a series of security activities that should be performed during all phases of system software application design and development, and operations, when development takes place in a cloud environment.)
SSE - security services edge (A collection of integrated, cloud-centric security capabilities that facilitates safe access to websites, software-as-a-service (SaaS) applications, and private applications.)
SSE - Security Services Engineering (Service within a Security Operations Center (SOC) providing low-level design consulting and engineering in support of information security tools and projects.)
SSE - Server Side Encryption (Encryption capability which encrypts data when it is being saved by a server, for data at rest protection, in contrast to client side encryption.)
SSH - Secure Shell (A program and set of protocols that first, establish a secure connection between remote devices, known as "tunneling" and second, maintain confidentiality by encrypting messages transmitted over the secure shell.)
SSID - Service Set Identifier (The wireless network name, which is broadcast out to let wireless customers know it exists. It is often turned off, or cloaked, as a security measure, since it is broadcast in clear text.)
SSL - Secure Sockets Layer (A secure protocol that relies on digital certificates and public/private keys to set up authentication and encryption services between two hosts, and encrypts the entire session messages transmitted. SSL is now regarded as insecure and obsolete.)
SSL MitM- Secure Sockets Layer Man-in-the-Middle attack (Man-in-the-Middle attack in which an attacker is able to intercept communications sent over a Secure Sockets Layer (SSL), allowing them to decrypt and view, or steal, encrypted messages.)
SSL VPN- Secure Sockets Layer Virtual Private Network (A means of securing remote access to a secure web site, including the ability to encrypt messages transmitted. The process involves logging in to a Secure Sockets Layer (SSL)-protected Web page, which allows their Web browser to download software that connects them to the Virtual Private Network (VPN) which encrypts messages while they are connected to the network.)
SSM - Security Services Management (Managerial services provided to a Security Operations Center (SOC), either by a department within the SOC, or by a third party, such as serving as a primary liaison for integration of services between the SOC and other parts of the organization, in addition to third parties. SSM typically focuses o overall stability, cost performance, and optimization of services.)
SSMTP - Secure Simple Mail Transfer Protocol (An implementation of the Simple Mail Transfer Protocol (SMTP) which uses Secure Sockets Layer (SSL) and Transport Layer Security (TLS) to provide authentication and encryption services.)
SSO - Security Services Operations (Service within a security operations center (SOC) which focuses on managing and maintaining security tools, as well as supporting general operations of the SOC.)
SSO - Single Sign-On (An access control system that allows for the use of a single ID and password to gain access to all programs or services within system that the user is authorized to use, rather than having to re-enter IDs and passwords for each system separately.)
SSP - System Security Plan (Formal document that provides an overview of the security requirements for an information system or an information security program and describes the security controls in place or planned for meeting those requirements.)
STs - Smart Threats (A class of attackers with good technological skills.)
STAR - Security Trust Assurance and Risk (A Cloud Security Alliance (CSA) registry holding a collection of evaluations of cloud service providers focusing on security, that can be used for evaluation.)
STIG - Security Technical Implementation Guide (Guide providing a checklist of technical specifications needed during system implementation to comply with security requirements.)
STM - security threat management (also referred to as security event management (SEM)) (Tool or service which collects log information from various sources in a network, such as operating systems, security devices, and applications, analyzes and correlates the log data, to identify possible links or patterns, and reports potentially major incidents, as alerts or alarms, in real-time to an operator, for further investigation. Early STM tools were primarily involved in the identification of suspicious activity to be investigated. The STM/SEM function was an early version of security technology which would later be merged with security information management (SIM) (responding to and dealing with events) to form the current model, security information and event management (SIEM), which both looks for threat activity and acts to contain or eliminate threats.)
STRIDE - Spoofing, Tampering, Repudiation, Information, Disclosure, Denial of Service, and Elevation of Privileges (Threat model method which incorporates the types of anticipated threats and provides a rough "checklist" of development actions needed to address those threats.)
SYN - Synchronize or synchronous (Communication message used between two computers or systems to indicate the start of a communication session. One of the "flags" incorporated into a transmisson packet used in the Transmission Control Protocol (TCP) to signal to the receiving computer the start of the message.)
SYN/ACK - Synchronize/Acknowledgment packet (A Transmission Control Protocol (TCP) process, known as a "three-way handshake," used to initiate and maintain a communication session between two hosts. A host sends out a Synchronize (SYN) transmission packet to initiate a session. The receiver acknowledges this request by sending a SYN/ACK (Synchronize/Acknowledgment) packet, which the initial sender acknowledges with its own Acknowledgment (ACK) packet, allowing the communication session to begin.)
SysAdmin - System Administrator (Individual responsible for administering a system, which can involve selecting new software and installing upgrades, and maintenance, as well as staffing, and repairing or restoring systems to operational status following disruptions.)